Hey guys, I've looked through the PHP Docs and can't see anything to do with this, so how can I test if a string is URL encoded? Is it better to search the string for characters which would be encoded, which aren't, and if any exist then its not encoded, or use something like this which I've made

How would the string come to be URL-encoded by the time your PHP script sees it? Is the problem really that your script needs to URL-decode an incoming string, or is the problem that your script needs to not double-encode a link href or input value, for instance?
–
user212218Nov 11 '11 at 23:13

11 Answers
11

You'll never know for sure if a string is URL-encoded or if it was supposed to have the sequence %2B in it. Instead, it probably depends on where the string came from, i.e. if it was hand-crafted or from some application.

Is it better to search the string for characters which would be encoded, which aren't, and if any exist then its not encoded.

I think this is a better approach, since it would take care of things that have been done programmatically (assuming the application would not have left a non-encoded character behind).

One thing that will be confusing here... Technically, the % "should be" encoded if it will be present in the final value, since it is a special character. You might have to combine your approaches to look for should-be-encoded characters as well as validating that the string decodes successfully if none are found.

"supposed to have the sequence %2B in it", his decode-check-encode-check is an attempt to counter this (decode to space, encode to %2B, not encoded)
–
falstroOct 28 '09 at 15:01

True, unless the intent was to pass that sequence as the final value... Your arithmetic example is a better example where that would fail. Instead, by checking for characters that "should have" been encoded, the application gets a little better clue whether the string is already encoded.
–
jheddingsOct 28 '09 at 15:08

There's no reliable way to do this, as there are strings which stay the same through the encoding process, i.e. is "abc" encoded or not? There's no clear answer. Also, as you've encountered, some characters have multiple encodings... But...

Your decode-check-encode-check scheme fails due to the fact that some characters may be encoded in more than one way. However, a slight modification to your function should be fairly reliable, just check if the decode modifies the string, if it does, it was encoded.

It won't be fool proof of course, as "10+20=30" will return true (+ gets converted to space), but we're actually just doing arithmetic. I suppose this is what you're scheme is attempting to counter, I'm sorry to say that I don't think there's a perfect solution.

HTH.

Edit:
As I entioned in my own comment (just reiterating here for clarity), a good compromise would probably be to check for invalid characters in your url (e.g. space), and if there are some it's not encoded. If there are none, try to decode and see if the string changes. This still won't handle the arithmetic above (which is impossible), but it'll hopefully be sufficient.

"However, a slight modification to your function should be fairly reliable, just check if the decode modifies the string, if it does, it was encoded." I thought this, however if this is the string "Hello+World how are you" then decoding it will produce a change, but it would not have been fully encoded.
–
PsytronicOct 28 '09 at 15:04

@Psytronic: Very true, that + is a bugger isn't it. If you can find a way to determine if it's a valid URL, and then decoding to check for a change would probably be a better solution. You should be able to devise a regular expression to look for 'bad'-characters like space (if it's not valid, it's not encoded).
–
falstroOct 28 '09 at 15:15

If a string has already been urlencoded, the only characters that will changed by double encoding are % (which starts all encoded character strings) and + (which replaces spaces.) Change them back and you should have the original string.